The field of the invention is computer network security, and more specifically a system for rapidly identifying and processing incoming packets from a computer network.
Many computer network security tools require a high performance packet-processing capability to identify, classify and act upon on incoming data packets according to predefined rules. Over the years, increasing network carrying capacity and speed, and increasing use of the Internet, have resulted in a large increase in the number of data packets routed into systems connected to data networks. Further, the average degree of complexity of actions that are performed on those data packets has increased, due to the increased number of security threats that may be carried over a computer network. For example, distributed denial of service (DDOS) attacks flood one or more computers with a vast number of packets, such that the target computer cannot effectively process other data, blocking access to those one or more computers by individuals or entities wishing to connect legitimately to that target computer. The recent spread of such DDOS attacks on well-known companies through the World Wide Web shut down many e-commerce web sites and network business activities, and highlighted the potential security threats posed by network connections.
Existing packet-processing systems typically deal with packet complexity and volume in an ad hoc way, and rely on one or more complicated application specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) dedicated to packet processing, thereby providing a fast but inflexible solution. A general processor may be integrated with the dedicated packet processing ASICs or FPGAs in an attempt to provide flexibility to the system. However, such integration generally provides poor results, degrading the overall performance of the packet processing system. Further, existing packet processing systems typically use a time-expensive hashing mechanism to assign rules to packets and process them, further degrading packet processing performance.
Thus, there is a need for a system and method for providing efficient integration of processors for data packet processing. Further, there is a need for a system and method for providing more efficient complex processing of data packets routed into computer systems. Further, there is a need for a system and method for organizing complex processing of data packets.